I am reading the cryptography book by Stamp and there is a cut-and-paste attack on $ECB$ and this is easy to follow because $ECB$ is relatively simple, the problem is that I would like to see an example of this in $CBC$ mode. Is there an easy example to show this?
Here is a nice explanation from the efail presentation, credits to Jens and Chris! This is for CBC but it looks pretty much the same for CFB.
But if you know what $P_1$ was in the beginning you can basically XOR it with whatever you want and thus insert blocks into the decrypted plaintext at the cost of randomizing every other block. So the ciphertext is clearly malleable.
This can be exploited if the randomized blocks can be escaped somehow on the application level or similar. Again a picture from one of the efail presentations: Here the randomized blocks are ignored because they are put inside quotes and the HTML parser ignores quoted strings without an attribute name.
In cut-and-paste one part of ciphertext is replaced by another ciphertext with known (or at least, known legible) plaintext, so the resulting message has a different meaning to the receiver of the encrypted message. It should be avoided by using authenticated encryption.
There is probably not a direct copy-and-paste attack on CBC in a similar way as there is for ECB. The plaintext of CBC is retrieved after XOR with the previous ciphertext block. So you would not have to just cut-and-paste the previous block for the target block to make sense. However, since that block is also decrypted, using the block before that, the block before the plaintext block is now randomized. Similarly, the block after the changed block is altered as well (although at least in a way known to the adversary).
Now if the IV is prefixed then you can replace any amount of blocks at the start of the cipher, and they will be converted in known plaintext - if that plaintext is known for another ciphertext encrypted with the same key. The only problem is that the block thereafter is changed as well. Obviously the same kind of reasoning works for the last block.
Does that mean that CBC is invulnerable against such cut-and-paste attacks? Well, no. There are many instances where random data is perfectly acceptable. Say we have a message that consists of a large number with any possible value followed by a boolean that indicates some kind of access condition. Now we can replace the bytes of the modulus with random data, and replace the boolean with a known value, say
true instead of
false. I guess that this is an example you can live with, as it even works with a randomized IV.
Plaintext 1: [ number ][ number | true ] Ciphertext 1: [ IV1 ][ CT1 / 1 ][ CT1 / 2 ] Plaintext 2: [ number ][ number | false ] Ciphertext 2: [ IV2 ][ CT2 / 1 ][ CT2 / 2 ] Attacked: [ IV2 ][ CT1 / 1 ][ CT1 / 2 ] Decrypted: [ random ][ number | true ]
However, if we study this problem further we'll see that this problem is actually larger. Say that
false is represented by a byte valued
true is represented by any value other than
00 (hi there, C programmers). In that case you can just randomize the last block and have the value be changed with likelihood of 255 out of 256. So we really don't need cut-and-paste at all.
Attacked: [ IV2 ][ CT2 / 1 ][ random ] Decrypted: [ number ][ random | bool? ]
bool? = false with chance 1 in 256 and
bool? = true with chance 255 in 256.
Even worse, with plaintext and padding oracle attacks, we may even be able to decrypt the entire message by using attacks such as these.
So the answer is: no, the exact cut-and-paste technique may not work for textual messages read by humans. However, modern cryptography doesn't generally target such messages, and CBC is really vulnerable against attacks that are very much like the cut-and-paste technique.
With the bit flipping attack used on the IV, the attacker may still be able to change a letter into a different one in the initial block without disturbing any other part of the plaintext.
This is why we use to create an authentication tag to protect the integrity and authenticity of messages nowadays. There are almost an infinite number of ways that undetected alteration of the message can wreak havoc on a system.
Even with integrity and authentication, you can always cut-and-paste an entire message, including IV and authentication tag. This is a replay attack, and you need separate measures such as a unique session counter to avoid those.
Attacking CBC is much harder than ECB. In many cases there is no viable attack. Properly implemented CBC with a secure underlying block cipher is secure. There have been successful attacks against padding in CBC, though non were anywhere as simple as attacking ECB. Look at: https://en.wikipedia.org/wiki/Padding_oracle_attack https://en.wikipedia.org/wiki/POODLE
There are also attacks on implementations of CBC with predicatble IVs e.g: https://www.netsparker.com/blog/web-security/how-the-beast-attack-works/
CBC has lost favor not because it is insecure in itself but because it is easy to implement poorly and there have been many attacks. If you expect anything remotely as simple as attacks on ECB I am happy to inform you these do not exist nor are expected.
Edit: I seem to have missed the point of the question, it was about manipulating cipher text. CBC is probably the least malleable of the common block cipher modes(harder than ECB or CTR) and yet without a authentication of some sort a MAC, or GCM or such CBC can still be manipulated, specifically if you have wiggle room and are willing to create a junk plain text block at your cut and paste boundary. If you know the plain text of a given block, you can replace it with a plain text of your choice by manipulating the previous cipher text blcok. calculate the xor diff between current plain text and desired plain text and apply it to previous cipher text block. This will cause the previous block to decipher into gibberish and the target blcok to be deciphered into whatever you want.